diff --git a/.github/workflows/assign.yml b/.github/workflows/assign.yml
index 1ac9f7cd..9a50a158 100644
--- a/.github/workflows/assign.yml
+++ b/.github/workflows/assign.yml
@@ -15,6 +15,10 @@ on:
   pull_request:
     types: [opened, ready_for_review]
 
+permissions:
+  contents: read # to read configuration file
+  pull-requests: write # to assign PRs
+
 jobs:
   add-reviews:
     runs-on: ubuntu-latest